Repository

Source, issues, and history for this Test IdP live in Azure DevOps.

Source control

Project: BizlLabs
Repo: TestIdp
URL: https://dev.azure.com/bizlibrary/BizlLabs/_git/TestIdp

What this is

A local, Dockerized identity provider for testing login integrations. It speaks SAML 2.0 and LDAP/LDAPS, and both protocols project the same user file (config/users.yaml) through one shared accessor (src/core/directory.js) — no adapter parses YAML or checks a password itself. It also does deliberate failure injection ("chaos") so client applications can be proven to reject bad assertions/binds for the right reasons, not just accept the happy path.

Technologies used

Runtime & core

Tech	Used for
Node.js ≥22	Runtime. Plain ESM (`"type": "module"`), no build step — source runs directly.
Express 5	HTTP server, routing for the SAML endpoints, LDAP admin UI, and JSON API.
EJS	Server-rendered admin/dashboard views (this page included).
zod	Schema validation for config loaded from `config/*.yaml`.
yaml	Parsing/writing `config/users.yaml`, `service-providers.yaml`, etc.
chokidar	Watches `config/` so edits reindex the directory with no restart.
pino	Structured logging (`pino-pretty` for readable dev output).

SAML 2.0

Hand-rolled on lower-level XML libraries rather than a wrapper like samlify, specifically so failure injection gets byte-level control over the emitted XML (sign correctly, then tamper).

Tech	Used for
xml-crypto	XML-DSig signing and verification of assertions/responses.
xmlbuilder2	Building the SAML XML documents before signing.
xpath	Node lookups when parsing incoming `AuthnRequest`s.
@xmldom/xmldom	DOM implementation backing the above.
node-forge	Local CA + leaf certificate generation/rotation for signing and TLS.

LDAP

Tech	Used for
ldapjs 3.0.7	The only Node library that can serve LDAP; pinned to an exact version and confined to `src/ldap/server.js`. LDAPS-only (no StartTLS — an `ldapjs` limitation).

Auth & sessions

Tech	Used for
bcryptjs	Optional password hashing for user records (plaintext is also supported, since this is test tooling).
cookie-parser	Session cookie handling for the web login flow.

Testing

Tech	Used for
node:test	Whole suite (`test/*.test.js`) — no Mocha/Jest. Exercises real sockets/HTTP rather than mocking `xml-crypto`/`ldapjs`.
@node-saml/node-saml	Used only by the demo SP (`apps/saml-sp-demo`) — a deliberately different library from what the IdP signs with, to cross-check SAML output against an independent verifier.

Deployment

Tech	Used for
Docker / Docker Compose	Full local stack (IdP + both demo SPs); `docker-compose.dev.yml` overlay adds live reload.
AWS CloudFormation	`aws/ecr-ecs-express.yaml` — ECS Express Mode service pulling from an ECR repo the same template creates, for a sandbox deployment.